CVE & Exploit Intelligence Database

CVE-2026-28426 8.7 HIGH 1 PoC Analysis EPSS 0.00

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, stored XSS vulnerability in svg and icon related components allow authenticated users with appropriate permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This has been fixed in 5.73.11 and 6.4.0.

CWE-79 Feb 27, 2026

CVE-2026-2898 5.5 MEDIUM 2 PoCs Analysis EPSS 0.00

A vulnerability was detected in funadmin up to 7.1.0-rc4. This issue affects the function getMember of the file app/common/service/AuthCloudService.php of the component Backend Endpoint. The manipulation of the argument cloud_account results in deserialization. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CWE-502 Feb 22, 2026

CVE-2026-27198 8.8 HIGH 1 PoC 1 Writeup Analysis EPSS 0.00

Formwork is a flat file-based Content Management System (CMS). In versions 2.0.0 through 2.3.3, the application fails to properly enforce role-based authorization during account creation. Although the system validates that the specified role exists, it does not verify whether the current user has sufficient privileges to assign highly privileged roles such as admin. As a result, an authenticated user with the editor role can create a new account with administrative privileges, leading to full administrative access and complete compromise of the CMS. This issue has been fixed in version 2.3.4.

CWE-269 Feb 21, 2026

CVE-2019-25317 6.4 MEDIUM 1 PoC Analysis EPSS 0.00

Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into timesheet descriptions. Attackers can insert SVG-based XSS payloads in the description field to execute arbitrary JavaScript when the page is loaded and viewed by other users.

CWE-79 Feb 11, 2026

CVE-2018-25157 6.4 MEDIUM 1 PoC Analysis EPSS 0.00

Phraseanet 4.0.3 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through crafted file names during document uploads. Attackers can upload files with embedded SVG scripts that execute in the browser, potentially stealing cookies or redirecting users when the file is viewed.

CWE-79 Feb 11, 2026

CVE-2020-36947 7.1 HIGH 1 PoC Analysis EPSS 0.00

LibreNMS 1.46 contains an authenticated SQL injection vulnerability in the MAC accounting graph endpoint that allows remote attackers to extract database information. Attackers can exploit the vulnerability by manipulating the 'sort' parameter with crafted SQL injection techniques to retrieve sensitive database contents through time-based blind SQL injection.

CWE-89 Jan 27, 2026

CVE-2026-23626 6.8 MEDIUM 1 PoC 1 Writeup Analysis EPSS 0.00

Kimai is a web-based multi-user time-tracking application. Prior to version 2.46.0, Kimai's export functionality uses a Twig sandbox with an overly permissive security policy (`DefaultPolicy`) that allows arbitrary method calls on objects available in the template context. An authenticated user with export permissions can deploy a malicious Twig template that extracts sensitive information including environment variables, all user password hashes, serialized session tokens, and CSRF tokens. Version 2.46.0 patches this issue.

CWE-1336 Jan 18, 2026

CVE-2021-47763 8.2 HIGH 1 PoC Analysis EPSS 0.00

Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter that allows attackers to inject malicious database queries. Attackers can manipulate the sort parameter to reveal table and column names by sending crafted GET requests to the jsonapi/review endpoint.

CWE-89 Jan 15, 2026

CVE-2023-53957 9.8 CRITICAL 1 PoC Analysis EPSS 0.00

Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies through malicious exploitation. Attackers can trick victims into executing a crafted PHP script that captures and writes session cookie information to a file, enabling potential session hijacking.

CWE-1275 Dec 19, 2025

CVE-2023-53929 8.8 HIGH 1 PoC Analysis EPSS 0.00

phpMyFAQ 3.1.12 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into their profile names. Attackers can modify their user profile name with a payload like 'calc|a!z|' to trigger code execution when an administrator exports user data as a CSV file.

CWE-1236 Dec 17, 2025

CVE-2024-58303 1 PoC Analysis EPSS 0.00

FoF Pretty Mail 1.1.2 contains a server-side template injection vulnerability that allows administrative users to inject malicious code into email templates. Attackers can execute system commands by inserting crafted template expressions that trigger arbitrary code execution during email generation.

CWE-1336 Dec 11, 2025

CVE-2025-65346 9.1 CRITICAL 1 PoC Analysis EPSS 0.00

alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The unzip/extraction functionality improperly allows archive contents to be written to arbitrary locations on the filesystem due to insufficient validation of extraction paths.

CWE-22 Dec 04, 2025

CVE-2025-65345 6.5 MEDIUM 1 PoC Analysis EPSS 0.00

alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The zip/archiving functionality allows an attacker to create archives containing files and directories outside the intended scope due to improper path validation.

CWE-22 Dec 03, 2025

CVE-2025-66294 8.8 HIGH 1 PoC Analysis EPSS 0.38

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) vulnerability exists in Grav that allows authenticated attackers with editor permissions to execute arbitrary commands on the server and, under certain conditions, may also be exploited by unauthenticated attackers. This vulnerability stems from weak regex validation in the cleanDangerousTwig method. This vulnerability is fixed in 1.8.0-beta.27.

CWE-1336 Dec 01, 2025

CVE-2025-64027 6.1 MEDIUM 1 PoC Analysis EPSS 0.00

Snipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability in the CSV Import workflow. When an invalid CSV file is uploaded, the application returns a progress_message value that is rendered as raw HTML in the admin interface. An attacker can intercept and modify the POST /livewire/update request to inject arbitrary HTML or JavaScript into the progress_message. Because the server accepts the modified input without sanitization and reflects it back to the user, arbitrary JavaScript executes in the browser of any authenticated admin who views the import page. NOTE: this is disputed by the Supplier because the report only demonstrates that an authenticated user can choose to conduct a man-in-the-middle attack against himself.

CWE-79 Nov 20, 2025

CVE-2025-61922 9.1 CRITICAL 2 PoCs Analysis EPSS 0.00

PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. Starting in version 1.3.0 and prior to versions 4.4.1 and 5.0.5, missing validation on the Express Checkout feature allows silent login, enabling account takeover via email. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.

CWE-287 Oct 16, 2025

CVE-2025-61183 6.1 MEDIUM 1 PoC 1 Writeup Analysis EPSS 0.00

Cross Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar() method of UserBase.php

CWE-79 Oct 08, 2025

CVE-2025-10353 1 PoC 1 Writeup Analysis NUCLEI EPSS 0.02

File upload leading to remote code execution (RCE) in the “melis-cms-slider” module of Melis Technology's Melis Platform. This vulnerability allows an attacker to upload a malicious file via a POST request to '/melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm' using the 'mcsdetail_img' parameter.

CWE-43 Oct 08, 2025

CVE-2025-10351 1 PoC Analysis EPSS 0.00

SQL injection vulnerability based on the melis-cms module of the Melis platform from Melis Technology. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'idPage' parameter in the '/melis/MelisCms/PageEdition/getTinyTemplates' endpoint.

CWE-89 Oct 08, 2025

CVE-2025-10909 2.4 LOW 1 PoC Analysis EPSS 0.00

A security flaw has been discovered in Mangati NovoSGA up to 2.2.9. The impacted element is an unknown function of the file /admin of the component SVG File Handler. Performing manipulation of the argument logoNavbar/logoLogin results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited.

CWE-94 Sep 24, 2025